HHostingByteSoftware
Ctrl K
ComunidadGuías…

docker/Dockerfile

Rama main · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
# syntax = docker/dockerfile:1.2
# Base stage
# laravel/octane sets a minimum FrankenPHP version and enforces it at startup, so this tag and the
# Octane range in api/composer.json move together. The build fails below when they don't match.
# 1.13.2 ships PHP 8.2.35, which fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619). Don't go below it.
FROM dunglas/frankenphp:1.13.2-php8.2-bookworm AS base

# Install packages
# default-mysql-client provides mysqldump (MariaDB's), which db:backup runs. Without it every
# backup failed; the old command hid that and uploaded empty 20-byte gzip files.
RUN apt-get update && apt-get install -y git bind9-utils mycli default-mysql-client nodejs npm nano uuid-runtime \
  && mkdir -p /root/.ssh \
  && ssh-keyscan github.com >> /root/.ssh/known_hosts

# Install PHP Extensions
RUN install-php-extensions \
  pdo_mysql \
  gd \
  bcmath \
  redis \
  intl \
  zip \
  gmp \
  apcu \
  opcache \
  memcached \
  imagick \
  # geos \
  sockets \
  pcntl \
  xdebug \
  @composer

# Install build dependencies for GEOS
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
       pkg-config \
       libgeos-dev \
       libgeos++-dev \
       autoconf \
       build-essential \
       unzip \
    && rm -rf /var/lib/apt/lists/*

# Download, extract, compile, and enable the php-geos extension
RUN curl -fsSL -o php-geos.zip \
      https://github.com/libgeos/php-geos/archive/dfe1ab17b0f155cc315bc13c75689371676e02e1.zip \
    && unzip php-geos.zip \
    && rm php-geos.zip \
    && cd php-geos-* \
    && ./autogen.sh \
    && ./configure \
    && make -j"$(nproc)" install \
    && docker-php-ext-enable geos \
    && cd .. \
    && rm -rf php-geos-*

# Update PHP configurations
# post_max_size is bounded (it was 0, unlimited) and session upload progress is off: both narrow the
# PHP2Shell attack paths (https://www.php.net/archive/2026.php#2026-10-21-5). The version check fails
# the build if the base image ever ships a PHP 8.2 without the fix.
RUN sed -e 's/^expose_php.*/expose_php = Off/' "$PHP_INI_DIR/php.ini-production" > "$PHP_INI_DIR/php.ini" \
  && sed -i -e 's/^upload_max_filesize.*/upload_max_filesize = 600M/' -e 's/^post_max_size.*/post_max_size = 610M/' \
  -e 's/^memory_limit.*/memory_limit = 600M/' "$PHP_INI_DIR/php.ini" \
  && printf 'session.upload_progress.enabled = 0\n' > "$PHP_INI_DIR/conf.d/zz-fleetbase-security.ini" \
  && php -r 'if (version_compare(PHP_VERSION, "8.2.35", "<")) { fwrite(STDERR, "PHP " . PHP_VERSION . " is vulnerable to PHP2Shell; need 8.2.35+\n"); exit(1); }' \
  && php -r 'if (ini_get("session.upload_progress.enabled")) { fwrite(STDERR, "session.upload_progress.enabled is still on\n"); exit(1); }'

# Install global node modules
RUN npm install -g chokidar pnpm ember-cli npm-cli-login

# Install ssm-parent
COPY --from=ghcr.io/springload/ssm-parent:1.8 /usr/bin/ssm-parent /sbin/ssm-parent

# Create the pnpm directory and set the PNPM_HOME environment variable
RUN mkdir -p ~/.pnpm
ENV PNPM_HOME=/root/.pnpm

# Add the pnpm global bin to the PATH
ENV PATH=/root/.pnpm/bin:$PATH

# Set some build ENV variables
ENV LOG_CHANNEL=stdout
ENV CACHE_DRIVER=null
ENV BROADCAST_DRIVER=socketcluster
ENV QUEUE_CONNECTION=redis
ENV CADDYFILE_PATH=/fleetbase/Caddyfile
ENV CONSOLE_PATH=/fleetbase/console
ENV OCTANE_SERVER=frankenphp
# Xdebug is installed for coverage runs, which set XDEBUG_MODE=coverage themselves. Left at
# its "develop" default it roughly doubled every request's time and disabled the OPcache
# JIT in every image built from here, production included.
ENV XDEBUG_MODE=off
ENV FLEETBASE_VERSION=0.7.75

# Set environment
ARG ENVIRONMENT=production
ENV APP_ENV=$ENVIRONMENT

# Setup github auth
ARG GITHUB_AUTH_KEY

# Copy Caddyfile
COPY --chown=www-data:www-data ./Caddyfile $CADDYFILE_PATH

# Create /fleetbase directory and set correct permissions
RUN mkdir -p /fleetbase/api && mkdir -p /fleetbase/console && chown -R www-data:www-data /fleetbase

# Generate and store a UUID in .fleetbase-id
RUN uuidgen > /fleetbase/api/.fleetbase-id

# Export the same ID as an environment variable for use in the container
RUN export FLEETBASE_INSTANCE_ID=$(cat /fleetbase/api/.fleetbase-id) && \
    echo "FLEETBASE_INSTANCE_ID=$FLEETBASE_INSTANCE_ID" >> /etc/environment

# Set working directory
WORKDIR /fleetbase/api

# If GITHUB_AUTH_KEY is provided, create auth.json with it
RUN if [ -n "$GITHUB_AUTH_KEY" ]; then echo "{\"github-oauth\": {\"github.com\": \"$GITHUB_AUTH_KEY\"}}" > auth.json; fi

# Prepare composer cache directory
RUN mkdir -p /var/www/.cache/composer && chown -R www-data:www-data /var/www/.cache/composer

# Optimize Composer Dependency Installation
COPY --chown=www-data:www-data ./api/composer.json ./api/composer.lock /fleetbase/api/

# Pre-install Composer dependencies
RUN su www-data -s /bin/sh -c "composer install --no-scripts --optimize-autoloader --no-dev --no-cache"

# Fail the build if this image's FrankenPHP is older than the installed Octane requires. Octane would
# otherwise delete the binary on startup and every app container would exit 127.
# See docker/scripts/assert-frankenphp-version.php.
RUN --mount=type=bind,source=docker/scripts/assert-frankenphp-version.php,target=/tmp/assert-frankenphp-version.php \
  php /tmp/assert-frankenphp-version.php /fleetbase/api/vendor/autoload.php

# Setup application
COPY --chown=www-data:www-data ./api /fleetbase/api

# Dump autoload
RUN su www-data -s /bin/sh -c "composer dumpautoload"

# Setup composer root directory
RUN mkdir -p /root/.composer
RUN mkdir -p /fleetbase/api/.composer && chown www-data:www-data /fleetbase/api/.composer

# Setup logging
RUN mkdir -p /fleetbase/api/storage/logs/ && touch /fleetbase/api/storage/logs/laravel-$(date +'%Y-%m-%d').log
RUN chown -R www-data:www-data /fleetbase/api/storage
RUN chmod -R 755 /fleetbase/api/storage

# Set permissions for deploy script
RUN chmod +x /fleetbase/api/deploy.sh

# Install go-crond
RUN curl -L https://github.com/webdevops/go-crond/releases/download/23.12.0/go-crond.linux.amd64 > /usr/local/bin/go-crond && chmod +x /usr/local/bin/go-crond
COPY docker/crontab ./crontab
RUN chmod 0600 ./crontab

# Scheduler dev stage
FROM base AS scheduler-dev
ENTRYPOINT []
CMD ["go-crond", "--verbose", "root:./crontab"]

# Scheduler stage
FROM base AS scheduler
ENTRYPOINT ["/sbin/ssm-parent", "-c", ".ssm-parent.yaml", "run", "--"]
CMD ["go-crond", "--verbose", "root:./crontab"]

# Events stage
FROM base AS events
ENTRYPOINT ["/sbin/ssm-parent", "-c", ".ssm-parent.yaml", "run", "--", "docker-php-entrypoint"]
CMD ["php", "artisan", "queue:work"]

# Events stage
FROM base AS events-dev
ENTRYPOINT []
CMD ["php", "artisan", "queue:work"]

# Application dev stage
FROM base AS app-dev
ENTRYPOINT ["docker-php-entrypoint"]
CMD ["sh", "-c", "php artisan octane:frankenphp --max-requests=1000 --port=8000 --host=0.0.0.0 --watch"]

# Application release stage
FROM base AS app-release
ENTRYPOINT ["docker-php-entrypoint"]
CMD ["sh", "-c", "php artisan octane:frankenphp --max-requests=1000 --port=8000 --host=0.0.0.0"] 

# Application stage
FROM base AS app
ENTRYPOINT ["/sbin/ssm-parent", "-c", ".ssm-parent.yaml", "run", "--", "docker-php-entrypoint"]
CMD ["sh", "-c", "php artisan octane:frankenphp --max-requests=1000 --port=8000 --host=0.0.0.0"]